CVE-2016-10537
Medium
Description
backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `<` to `<`.
SeverityMedium
CVSS5.4
Exploit probability—
ProductBackbone
PublishedMay 31, 2018
First seenMay 31, 2018
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- backbone0.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| backbone_project backbone | v ≤ 0.3.3 | — |
| backbonenpm | 0.3.3 ≤ v < 0.5.0 | 0.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.